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' [0001] ' fhisinvention relates to methods and appara- T 
tus for 'generating sen/ic^j^ and to moni-" 

toring systems for collecting data for tnese records from 
a network, such as a packet.data network, which is used 
■ ~" fdrWxample to carry -multimedia te[ephqny-1service§ as 
described in the International Telecommunication : Un-r 
ion's recommendation H.323 or the jnternetEngineejing 
r ' Task Force's multirriedia i data and donfrol architectlire 
f ^ including the Session Iriitetbo' ProtcpoL (SiP)7 These 
: * and similar stindards'deffhe a;set j>f protocols r for es- 
~ tab'lishirig sessions qr calls which indy Include one oc 
more users and one or more servers, communicating 
~ Via one or more multimedia Channels: V ' J ' f 

" Background * -e.~no.Zt.-: o rvc. . ■ r> * v-: • 
: — , • ;-zw ;r:.-*:;h.v.^ ■:: w-h^y, 

[0002] The provision of multimedia ^ communications 
- services over a packet data network '(P'D 

not provide quality of service > gjuarahte^ 
: gen erated a greait deal of inte rest due to ihe success of 
£ networks ba^sed on the internet protocols (TCP/1 fcrftet- . 
: ' work operators are' currently tnalin^muFtim 

hlcations services dveYa yanety of p'^l^'da^netmrte 
" sdch Ws Internet ProtccdlJ'IP); Frkme Selay (Ff% and 
' AsynChjo^^ 

f'is'to geWerat'e service detail records (geheralfsed call 
data re^rds); in^l-time or B^i^rpc^e', \^ic^meas- 
ure the serVfceVs&ge of individual usersand the sen/ice 

equality that L Was' actually experienced by the user 
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^[0X)03] Adcprdihg to on 

' is' provided a mejthqrfof generaMgjgene^ 

^ d^tafl records for communications : :.(sup^ k .a4~te)ep^my) 

' ^r^jed oyer a packet _riej^o>k/_com , 



^acquiring patcket h^etw^^ervfce da^Jf^m^pagkets 
carrying the co'mmunfcations;^ *~ ' ' ' , " . \ ^ '~ 
' - acquiring signalling ;dite jrom ? c a s'ignal|[ng protocol 
" to identify at least one of a&dressipgf pp , 
' status and timing jnjor^ 
keepers and connections jnvolvecTin" a Sail; and 
combining said packet service data and^said signal- 
Ijhg data to geper^e seryjce' detail records^ " 

[0004] According' to anbfter aspect jpf this: invention 
there" is' provided a method pt djscpyejing'the^n 
configuration of the ^end^intsi'^te teeners and thejcre- 
latioriships, for a cbrhmuhjcato 

' lephony)' carried by a PDK^ by. using a ^ passive'mpriitpr- 
ing system to capture the signal! in g messages' in vpfved 
in the configuration and negotiation relatipnships^'ad- 

; dressing ^nd. resource' allocation,' 1 between endppjnts 
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and gatekeepers. ^ . i+ 

[0005] Acco^dingloVfu'^ of this invention 

there is prpyicSed a method of* generating generalised 
service d^faiVrecorqs^ carried over 

r a packet * h^vyigrrH* iP^TlPji®^"^* 16 steps" of: t 

- ' . ^cqujrihg^pack^ service data for the paick- 
r . efe cajiying . 

acquiring signalling data regarding at least one of 
call control, registratipn, admissions, bandwidth 
management, call statasraddress" translation and 
, intelligent, network.sen/ices; . r .., Vi 
" acqjiipng quality" of service data for the seryice< 
„. tra'nsmi.ssjon [ leyel;'^hd r . ' 

- ^ combining ^sakl.^e.'rvfcet^te, said signalling data 
" and said'quality bf service data to generate gener- 
alised serviced . : 

- r&;± z- £-».;-ir.*. i vty\ t. : 
[0006] According to another aspect of this invention 

( there, is prpyidecj, a methpd. of mpnitor[ng a packet data 
subnetwork' Je.g. .et^hernet segm link (e g a T3 

link cgrryingjJP oyer a jRoinMo-Roint, Protocol - PPP), 
. comprising the steps of : r monitoring ata first location sig- 
" nailing messages to dejtect jhe existence of a calf; and 
monitoring 'at multiple othe^JocatipnSj to identify some 
or all pacKetsas$ociated,with the^caH (in H.323, the Gall 
ID c^n be used to. identify. all packet^associated with a 
^gryen .call), Jhe captured packets. may include both sig- 
nalling data! ^ncfdata from multimedia streams associ- 
ated with the .call- jt may be, required for wire^p appli- 
c^tibns, , fo> example Jtq use"ihe signalling data to identify 
' cSlls of interestV ind thea'captyr^^ multimedia 
..stream, Jt nrpy be t necessary ; tp ^bufi^r captured packets 
^ at ",e^cfi location, to ensure. that all packets associated 
with the call could be captured. , ^ r . 
[0007] , Jn ac]d|tioq, : the packets associated with a con- 
ference cali can be correlated tagethe/-to form a service 
record, fqr g conference caji..This cai^be achieved-by 
capturing all packets with the same conference ID in H. 
323, fbr example^ c v 

[0008] .ln.some. cases ,it may.be desirable to jnonitor 
addr||onal ^naillhg. messages,. k e r g.,-Signalling System 
No. ; 7 (S57>^protocpKmessag^ or Integrated Services 
Digital, Network. (I SDN) messages, -on signalling links in 
a switched pirciiit network (such as the public switched 
telephone network - PSTN) (^upied ; to said packet data 
network, or Media Gate way^Controlprptocoj messages 
(for example MGCP or SG CP). which are used to control 
"the gateway connection between the SCN and the PDN, 
. tp. derive additional monitoring data, and correlate those 
additional monitoring data with at least some of first 
monitoring data. These can, be correlated to the original 
call r t>y using.pharacteristics such as calling or called par- 
ty numbers Xo identify the, call. . , 
[0009] Thus the invention can involve monitoring the 
cpatrpl channels used for initiation, modification and ter- 
mination of muttjmedia,sessions, and. may include the 
monitoring of the "multimedia channels themselves,, to 
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operator to 



provide a service detail record for a session 
- [0010] the invention enables 'a nefwqric < . 
"generate service detail records (fah'pifre PDN, or on a 
" hybrid network <of Intercpn^ 
circuit networks (SCNsJ. VnefS" isalsb'describ'ed a meth- 
od for automatically discovering the network configura- 
tion information,* ihcluding aydres^trt^j and identifying 
the relationships between gatekeepers and endpoints. 

Brief Description of Drawings " 16 



ing call signalling messages; 
Figure 16 is a flow diagram of a profess, for monitor- 
ing control channels; and~ ~' 
Figure 1 7 , ; , Js a fiowdjagrarp of a^rpcess for. rqomtor- 
( ... Jf?9 ^JL'signaJUng channels ^ayjng^dy- 
. f .^Qamic T$£P identifiers/"..,/;/^.".; 

Best Mode for Carrying Out the Invention, ^Industrial 

" .Applicability . -; r ; :: ■ /: >; ~ :fc 



?5 



[0011] Methods arid apparatus^ in accprc^nce with 
this*- invention for generating telephorfe.'seryic'e detail 
records will now be described, ;by wa^df example, with 

-- J ' reference-to the accdrhpa'nyiri(& drawings, in which: 

u ' *u . ,; ; '£-"iv;: 3? • j^-.r. ^tj;.-ss '.v 

Figure 1 shows ^distributed mbHrtofing system for 
a PDN carrying multimedia voice seryic- 

•• Figure & r: ^ srtovis examples' of ^^tensibr?s 'ofThls' ar- 20 
"I* ,; e /chitefeiirre to :; cprf^ 
" " ' r ; with sigha'fflhg c^tafrbm 
F i gti re' r 3 ■'; ' c " sWows' the secju&ncte * of message .types 
**• ■, "'^jchcan'biela^'uredV 
-* : 10 <; "'"^ ^Ve3©^1>eicold; lr - J " n \'"J 

V J of^h6 structure : £f a 



P^eV<^ in 
~ ' tha cirgYwngs has ' the ca^afpiiity tp cojlect datagram a 
^ combinecl Ppf>l t an 

'" cqrrelale^ese a real-time 

, view of services on th'e'nefwor^^fpesiB data can be used 
for applications.s^ch'a suryelllaYice, 
security, netwofk^iannTng, provisibn v of accounting in- 
formation to customers, fraud detection, kfjlin&and ^ac- 
quisition of marketing information. 
[0013] ^Referrjng to. figure 1, the prplpes shawa-are 
^ ' pafroH^ system,' and a'r.e T pas- 

v ' sive tint rinon itorihg devices 1 (using techniques similar to 

\:. P} s o"$ p^^i >l n analyse %!pr ex ^p , ^>!J he 

' ' Jjjslrj^ut System is cc^^tr^pte^'frcypn .the 

1 "probes" arid standard computer and "communications 
componerjts T- wrth spec lal-purpose soft ware jyyjnich p { r f o- 
^ vid^Suthe applications iescribedabove. Apriricipatfuoc- 
tion of this s^ffvya^re is to correlate data from, s dffferent 



,r 'Figure : 4- fehdws^an . 

' " * :: - Si ' : " rt se^rvice^ec^ cbujcfjbfe Von^tfuBted 
-r -: c u j fro ffl rth ^ ^ a cStiected hif the rnonitofing 

' Figure ^ * ' ' r is a'flbw dia^rarrl of ^ pVoc§ss fbr'rnbnjtor- 
,0- ... ^^^^v^fh^ghaliin^m^^ 
1 4 ^ - keeper auto^discovery; ■ " * 



probds to provide a record or reai : tim0, trace : of calls, 





messages; 

: 'Figure 7 ° & ' &f srt<wS ^^Yelatfonsriip^eiWeen tne pfoc 
■ * n '^e^! : ^Fig^ 
l : -Figure &- c 0 J illus^tates il failure^mbd^ 
. ' C ■ r.: • 'the s ga1elieeper aulc^o^cov^iV^^ Rf^e-. 

''Figu7e : 9 fi ^~ila"flbw diagram 6l a prdcdfsS 'for^pftfibr- 
' r • _ " 1 £n -irrg'6ignafirng 'me5sk3^s" related to re^is- 
c ' : ' " ffatibn of ehdpbihts*w8h^^telce c eper^ 
Figure ; ta ,: - : fe¥flbvyr'dfe^ram of-a procff & for^xlrabt- 

: ' figure T1' : 7 is' a flbw diajgrarri bf;a prbce& fbr^extract- 
>c,i irig' data Trom enclpblht ^uh^ecjistraiibn 

• v • * * messages; ■ ; ; - . - . 
•-"Figura 12 ' ' iNustrktes poteritially 'anbmSfe 

" tron of endpoints wltff a gatekWpeir in a 
. : ■ •: different sub-nBt; : * £ " £C ( r " r : 

* Figure i 3 Illustrates 1 " potentially anomalous load im- 

balance between two' ^ale keepers in a 
sub-net; " 1 ' * " : 

' Figure 14- ' is : a flow diagram of a process for monltor- 
- v - .\ Hhg call signalling charihels; ' 

" Figure 15 •" ' is a flowdiagram of a process 'for monitor- 



could' 1oe~ used to implement 'parfs of the system'de- 
scribed above. . _ . . . 

35 [0014] A Data Managementirrfrastructure (OMi) eol- 
lects the data from the probes and processes the data 



?o |>?cpu£e^ records. Jhte bK/lT rjiaycphflst 

" ot sbfware^rDhrilhb on one or more computers, ahd the 
1 prdcdsslng of the data'aha its storage may be distributed 
40 across these computers. The service detail record gen- 
eratio^rocess may^ pp split betw.ee/i^the.prpbes and 
cJ 1he i tDMI.^Wpro^'es^^ detail 
records by^correlatjng all the informatiprr ^yajLqble on 
th^ft ^roBe E ab^>ut * a part icu lar "session and fprwardin g 
45 ;^dsb p riartral^e&^ The^QMl i$ then re- 

" c ipohslBfe'fbr coire service detaH/ecords 

frb?n .dfffefe forfrj trie final service detail 

redord^' Altel^ forward uricorre- 

lated ciak 'to the'DMCarid the^DMris then responsible 
for generating the comglete service .detail records. In 
TDoth cases the DMI' is also responsible for the storage 
\ of 'the service detail records and ^ 
^fprapplidation fq analyse the service detail 

' records*. 'This i aspect of trie D Ml may be implemejrited 
usirtg data r warehousing technology. 
[0015] *" 'Anjexample of a monitoring system ^ardhitec- 
" ture is given in Figure 2. This shows probes monitoring 
■ the PDN, §S7 network and ! the ISDN. TKe SS7 probes 



so 



ss 
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could bettor example t ,Horp the Hewlett-Packard 
acceSS7 sysiem. The ISDN primary rajte^access probes 
could for example be constructed using the same tech- 
njgues as in existing, protpcpl^analysers ,(§uch as the 
■ Hewle"tt : iF^acl^rcl l 37900D Signalling Test Set)* the PDN s 
probes could be ^constructed from Hewlett-Packard 

[0016] The di,stf^ 

* t8 correlate real-time, data frprn.any combination of 
these probes. This inoJudes^fprexample, ^ . . 10 

"from the S§? linK^ signalling from the J SON Jinks (e.g. 

'**- the D-chanhei for narrowband IS&N), the signaMiog data 
for the multimedia service from the PD^'and the multi- 
media stream data (e.g. data jridicating packet Joss Ja- 

* Jertcy 0/ jitter). It rrjay also ipcju.de the. capture of the, en- ; : is 
'tire munimedi^;stream, for ^plication$ (i^e,wire japping 
ortroubleshjDotihg. 7, "7 -77 

Ip^lT] - ^°^,9p!0)f^n\enceXhe i\hv^n^^^^^6r\ie^r\-' 

"ing IP as th eTP Qftf and Qjptjpna) ly 'cpjn ae^ted. to one' or w 20 

* rribreSCf^s using n 

\ ling;'wrth trunjcjj^^ 
^©/stood that $islerm^^ 

" within its scope ^alp£pu| functio^ij^ ^ethej p/^npt 
they are customarily Jde^ ;v 25 
' these^stalridarcW^ "7 77. . ' w ) S ^ 
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L'TheJPD^ 30 
ets that provide configuration inform^ 
points and gatekeepers? These packets may be cap- 
tured to create ajrjd^ 

discovery database) which gives configuration informa- 
tjpn, addressin^^^ between 
]he endgoinis ^nd gafe^eper^ '^e nej^rk pjiscoyery 
dat^ajs^ rrjay alsp J^(ce^teJ/o^ 
"supplement or verify theTcaptu red data. My-.dis.cr^pan- 
cies between the discovered data and the data from oth- 
er sources should, be Mse^L to generate,^. alarrg. to the 40 
network operator Wdicating a possible ^etwo'rkconfigy- 
ration problem." The details of the data captured are de- 
scribed in the following paragraphs. / .,7 /7 7 • v 
[0Q1 ?] . A type of transactionJ>vhigh js tracked .by the 
moh itoring system is th e gat ekeepe r d iscovery process . 45 
Th is is used by an endpoint to automatically find a gate- 
keeper whiph will provide service, to it. r Jhe, monitoring 
systerji r uses the data captured, from .the, sequent 
messages between the endpoint and the gatekeeper, to 
identify endpoirifs and gatekeepers and to build a data- <$o 
base of tfie rejajionships between.endppjnts and gate- 
keepers, the database stores information derived from 
the jcapjured data^ which., identifies the endpointv and 
.gat^keepe/. Th is includes, th e. network addresses and 
porjt numbers. The. monitoring system mpnitors .continr 55 
upusjy.fpc endpoint .discovery attempts,, to maintain, an 
acpu rate database, of trie network configuration. This 
monitoring process is described in more detail- below 



1 with reference to Fig^es; 5 to 8. v 2 
[0020] the endpoint may go through a registration 

. process with.. its ga^k@epervjhis propess may; be re- 

r ; peated periodically^^ has a finite lifetime. 

, TJie monitoring fysterrj^pnitors the^networK cpntinu- 

..ousfy for pacjkets involved -in the, registration process. 
.The monitoring system. captures the relevant packets 
.and I yse§ tWdaJa relating 1 to theendpqint and gatekeep- 
er to : update and add information to the database. This 
typically includes any transport addresses (transport ad- 
dress = (Network address, Transport layer Service Ac- 
cess Point (TSAP) or port number)),, anyralias address- 
es and any other addressing or configuration informa- 

. tion^gociated with the enclpoint or gatekeeper .-,,<>; ; 

r; {00^t} )!S Endppints,may also request from agatekeeper 
location information .for an endpoint for which it has the 

. alias. The mpnitorigg system will continuously; monitor 
fgpthe-exchange of packets associated with this location 
process and capture i data c f rom the relevant packejs. 
TH ia.data can be, used to update or add information to 

. Jhejjetwork . discovery database that identifies the rela- 

t tionship^betweeaalias.es, transport addresses and any 
other addressing or configuration information.- This may 

^ include information which identifies how to connect to a 
destination on the SCN (e.g. E. r 164 addresses). „Mo/e 

Jdetaijs of monitoring of the registration .process are giv- 
en .below, .with reference tp,Figures 9 to .1 3. . .. ; . 
[0022] Access tokens may be used to enab la an v end- 
pointtOjhiqJe .its transport address, f rom the endpoint ito 

. .v^ichJtjis.establishing cqriniunica.tion,. The> monitoring 
system will continuously monitpr the network to capture 

<; packet$Jhat are, used, ia^e^rpcess.pf; distributing ;ac- 

..P < e^^k^nsJgiendppinte ? * , H}e captured data is used to 
add to .qc, update Jnfqrmatipn, in the ; ne^work:database 
indicating^he^ token and 

c a$ enclpoint . : „ r ; * v , , - 



[0023] This section lists the types of fields in service 
records, and describes how : ttie- distributed monitoring 
system could provide the required data. A service record 
Js generated fqr each instance pf-theusage of a specific 
service. This is a generalisation.^ a pall Record; which 
is generated by current switches. A service is normally 
defined from the perspective of the user The service 
may actually involve a number of calls or transactions, 
for example. Injhe casewher.e only the PDN is betrlg 
. monitored, these service, records- include data from the 
signalling between, any combination of gateways, gate- 
keepers, terminals and,multi-point controllers; and data 
frpm the multimedia streams-controlled by this signal- 
ling. In the case where the SCNs connected to the PDN 
are being monitored, the service record will also include 
data from the signalling data on the SCN collected from 
the probes connected to the SCN. The network discov- 
ery database may be used in constructing the 'service 
records to fill-any address or configuration ^information 
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which is not available tdirectlj^fftim th£ packets involved 
• i :infhe : ca(l. *' 1 "y ty-con* e- : T 

c [0024] • Figure '3 s^ows*%nr e^Smple'lof f the sequence 

- ofpackets wfcfch may bSs'cap^^ed different levels in _ 
the overall stacKttfp^ ' s ■ 

^art urifeliable :/ datagram protocol- UDF^fo provide a 
service" deta'irrebbrd. Figufe" 4 Iflustrates hOfW : the infor- 
mation from these different parts of the-bveralHransac- 
tion can be used to cont'iitSiife to different respective 
partSof a service 'detail record.' * : <t m jo 

^Calling Part/lnfdrrriatidn. '* : ' v. 

- w . i'- v?. .i-' c 'lie .: * :-r. \ 1 - 

[0025J This^ludes an^ fi^ormatibn which caHbe'de- t 
">*rived abouRhe calling partyMronri the*- signalling data *s 
e:fldwYng on the PDN and 7s therefore-available to thelihk 
"mo'n'Udrihgpprcbes"-' 7yf»cai information Includes: calling 
f "pa r^y n umbo f -any • *s s ub -add ressin g * ihf orfhat ioh ; 
'calbricj pVrty^rtrc" network' addresses; TS AP or port 
numbOib fiiltrib ricfor'etkbcs and any' numbers^ 'or' ad- ~ ' 20 
diub^c^ itl'CitLd fjX'tiiifi^-'Thts informatiorVca^lie de- 
rived I r cn? e 'soqo&hc o ci messages used : to set up a 
tcair : ln;m<S4ir323 rc^cVhrrwndatioa this can be achieved 
by ewr/idt^g fhe't'cte&irit fields from the~ G?931 messag- 
& cs^oooavv sic'ttrng'tib-inc call : '(sot-upf call proceeding, 25 

- <ajertm§- ^onriocflbV OKrfmpWj. in the biases where one 
or mono ^ioVeo<:<KV rt/o involved Ih^admis'sibh signal- 
ling (H^S ARO^ ACF%nessageVfor : e&m 
twefe^^i^f^h^'^rt rWSdpi5int Is captured to identify 

P th£tegi^i 6tW^ f fie logical chain- so 

nefiHS* ryp^^'d^tViod'usVng^the^trah 
[0026] ^ : AbWionHllnforro^^^ bederived?rorri call 
-setup mes^*ip>s on r»e ISDN D'charinels of an intercoh- 
1 nected^SCN at e ther the" originating or term inat trig-end 
or both . ■ an&&- Uom ca If *set up-messages^6 l h^any^6f tn e 35 
SS7 links of tho SCN Additional informatidn^rnay also 
be derived from any intelligent network service messag- 
es that flow ovctfhdi ~SS7"links as 'part of'the'specific 
service us<igo 

: to-; r; :^,i'o2'.- . . :>■':* °*0 

; 2: Called Pafryjfflormation.- " - J '~ ■ - : :: ' 

-[0027] As for 'callng party information,-* but replace 
calling party by : callc^ p^rty. " - L ' : - bEr - - 



' 3>lnfdrmaiibri on eacrv party : in a conference. 



service usafge'. the foHqwjhg are 'exampleVoCdata 
which might oVprovided: *' ! 

logical c^annels;^ cail.and 'their 

identifiers, " V. "7/ ■-" ""l 

- the requested media^; codecs (cciief/decoders), 
service quality'a'nd fr^oWidtf^fpr eacj\chann*el," 
the negotiated media, cddecs, service .qu^Tjty ajid 

- bandwidth for each ch&hhelj, J ' \ /* . 
: - 'any oth'e r pe rf orrriancer brccfi'f ig u ratiori'dala' on the 

b S:hanrlWl^ which Sre requested^ 
' r: 'tnecaliiDr ^ conference/" : " "' tif 

EacK of^these u^es is" time-stamped, and.'tfie sequence 

* and na'ture*of the use indicated. TRese dala can'be pb- 

- ta'ined ih 1; a similar way as' was described for item 1,a&pye 
from the capture of packets carrying signalling in'fo.rfKa- 

" r tion;Mo"reVp^CificWliy the' logical channels can be jdeh- 
^tified b^usrrfg the fields^ with in an Open Logical Channel 
' sftucture^wlthln 'certain J nTessages defined in B.323 ; arid 
' asJscciateld ^^cdmmendations. S u bsec|ljent 4 messages 
" which 'control' theological channels are also monitored 
and any^chariges'ln channel configuration ^ cap ^ be time 

• Stamped aFid ia^dded to* the service ^ 
^[OOdtij " A Important addition at set of inforrhationiis trje 

measured quality of" service and bandwrdth'u'sage on 
each of the logical channels^ set-up as^par^pf the^cail. 
This will typically include "pacKet loss'rafes, latency arid 
jitter measurements which are made^oyer selec^ted^b- 
tervals'by captufihg packets frorri the logical chanheis 
anb'e^ractihgtheWlevantfields:' 1 ''' " tC: ^ '*"' 

5:SuVpfernentaty^Se^ ? 



AS 



[0031 ] ^This rriay 1 ihciude any ^ ipformatioh oh" supple- 
mentary service's tised"'f or* Vr\\$ specifib" service usage. 
-iTHe fblloWihg^re some exahSpfes of the data which'may 
&e^rovidecl: A FAit - '-^ '• ^■'•-■ ;?f y 

c calrfofwardin^ r indicati6h and' address ihTdrrnation; 
*' * interacfive r Voic6" Tespdhse' ihforrtia^ioh dri the 'use 
^ - 'of Mdlligerit^efipheralsV"" t£: '* , i: ' " '.1 
800 number sefrvices; 3 : r " V/v ' ' 
; * ' any T cus : tdm services that may be invoked during the 
^'-daii brccffte'renceT'' Sv// " c : 



[0028] ^^he equivaleVit* data to the calling party infor- 
'*matton v for each-party r in a conference/^with additional 
information * On the conference objective (join* confer- so 
r :ence| create -conference or invite for example) -and a 
■means td identify the conference (Conference ID : for ex- 
ample). . - : . 

4. Network Routing and Logical Channel Information. 55 



.[0029]. This may include i any information on the net- 
work resources which were used to provide this specific 



This ii^ormatfon includes time-stamps, duration and the 
* nature' 6?the T use. ^ TTiese data can be obtained in a sirh- 
ilar way as "was described fo r item r above . 

6. ^Service Status and Termination IhfdHriatiph. 

^[0032] : fRis may Include time-stamped jnformatiori oh 
"the initiation^ the^servrce; time-stamped information on 
~any r status changes occurring durihg service* and time- 
stamped infdrmatiSrr on the termination of the service, 
^e termihatioh Inf orrriatibn should ihciude the reasons 
for termination.' ' * - • 
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[0033] These data can be obtained in a similar way 
as was described for itern 1 above. In particular, the H. 
f 245 ehdSesJi^^^ call 
termjnatlon, nnessages, the^ pall . clearing messages^ on 
trie SSTIinks andtfiel^^ provide de- s 

tails qh the reasons J for call termination. 



[0034] The service quality information provided Lis ele-. io 
„ pendent on the service indicated in the service type field. 
" tJt e */^ pro- 
/videdlp^ ^ ~[~ 

* [0b35] : ' Voice quality is mainly indicated by the bit error 
rate, jitter and delay. These parameters jean be /rjgas- is 
ured .usin^ a. passive monitoring system ana" mqnjtqring 

at two 'points in the network. Signalling information.^an 
be used to identify the logical channels on the PDN, the 
ISDN B channels orJhe time slpts pn jSQNjiupks, that 
are carrying the* ybipe. signals. The'bjt sJtreamsTrpm each, : . 20 
of the channels or trunk time sloWldentif ied cari be com- 
, pared tp^dewe.the delay, jitterand £it er/or- ratecaused 

* bylKe intermediate networks. . ' T ■ "° 



1, a \i 
.-•J - 



2S 



' 6. Sefaice Usa<ge Information,^ ... * 

I0036J Jpf type gf usage data proyjdea\t^ 
ute^d mpnif on'rig sysjem dependspp th^.spepif ic service. 
§6me examples follow^ "V 
[Qte7l Voipe^ 30 
, ration ^nd usecl bandwid^^ 1,,^ . \ '. J".^ ''\ .'^ \ ^ 
[Q^L^I^ejxlaf^ prjented .seirv^ such 

" may^ : ^ 

tipn of the/s£rviqe^lt mjay alsp be'^pkeri down Jntb a v -35 
, traffic 
~dres>jn"'^ 

.'are f obJarhed*^ is d^scrtbed Jpr item 1 , 

a'bover ' .. '7 .V'"'/ " 'i.V. 1'. 



itoring system can, appjy, filtering criteria on, any -of the 
information described in the previous section, to select 
those. jn.star^s.otse^jce^eJor which real-time up- 
dates are r>qu|red~l l",J' y . I f , r . 'J . ~.[ _ '/.I ' . 

WIRE;TAR' r CAPABIL|l^ * 

[0042] Any of the data extracted from- the signalling 
messages can be used to match criteria set by the user 
of the monitoring system and trigger some pr.all of the 
logical channels to be captured in their entirety. This 
. technique can be used to provide a wire-tap capability, 
^which would allow real-time copies of the media streams 
to be routed through ,tl)e monitoring system to a ; third 
. party, or stored for analysis. The filtering could, also- be 
.on characteristics inJthe media stream : (for example, a 
specific spoken word in .an audio stream) yyhich,, if 
lrotqlTed, . y/ould trigger capture pf ..all Jhe service 
record information from the signalling messages, as de- 
scribed earlier. 

APPLICATIONS 

[004^3^ ^Thejollowjng applications can bejmplement- 
; ed r using the data^lrprn the service records described 
above, or the real-time^ service updates. Daja from other 
sources may Jbe used to,enhance the. effectiveness of 
these applications. 

A. Quality of Service and Service Level Agreements. 

J0.044J ,T he sesylpe. records .described, above can ; be 
use^^Ovppyide service quality infpr^matioaon-selepted 
customer's service. This can be used to track conform- 
ance to service level agreements, and be provided to 
the customer as an additional service. It can be provided 
as periodic reports, or in real-time using the real-time 
updates., described-above, . -^ .-.-.*-- 



,5. Security Iniformation. 



40 b. Surveillance, and ^ Troubleshooting for Network; 



1 ^particular instance ©if service^ usage may be 
an attempt to obtain unauthorised access.to "respu rces. 
The" service .reco/d includes information ^whieVrnay in- v ^ 
dicafe -thjis^pe of behaviour. Tbis, may include informa- 
tion about the duration of call, the way the call waVter- 
minated arid details of,the service used ^ w . v 
[0040] An example would be where there are repeat- 
ed failed .attempts to gain access toiJifferent resources. < so , 

REAL-TIME UPDATES ON SERVICE USE 

[0041] The. data that populates the service records 
desc.ribe.dJn the previous section can be collected in re- . ■. ss 
al-tirhe from the monitoring probes. These data can be 
provided in real-time on remotely connected computers, 
as they become available. A user of the distributed mon- 



Operatiohs. 

[0045] the service records and real- time- updates can 
be used to identify service or network faults. The infor- 
matiQn can. also r be.used to trpubleshopt the faults. •» 

0. Fraud Detection,. 

[0046] The service records and real-time updates can 
be used to identify potential fraudulent use.of the net- 
work or service. Indications may include excessive use 
of high value services,, unusual call termination ; behav- 
iour and repeated failures to gain access to a service. 
The distributed monitoring system.may be used to track 
the service usage of potential .high-risk users -in real- 
time. ... 
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: D . Security and H^ckihg J bete«fon ' " - 

V[0047] -Potential s*ecurity %Ye¥ts r: can be identified by 
repeated failures to gain access to J a Vervice. They also 
may be indicated by successful access to sensitive serv- 
ices, such as maintenance ports bn'cuslomer premises 
equipment (CPE). This type of data is available from the 
service records and the real-time updates. * 

' E. Billing Data ? " 

[0048] The service records can be used as a basis for 
" billing which' independent on any of the fields inthes'Srv- 
1 *ice record; This allows, for example, billing to be based 
r ' on- the actual service' quality delivered: It' also enables 

billing- to reflecTthe hature r and generation of the r use[ge 
l: of resources on the'netWork, such as intelligent perfph- 
' 'erals and databases. The'biiiing data cduid be Vnafoe 

available in- real-time. ^ ^ tfM 

F. Customer Accounting Data 

[0049] The detailed service usage information in the 
Service records "cart iSb provided to customers fonjse in 
their internal accounting. This includes the traffic' matrix 
1 ihfbrmatibh for packet and frame based protocols^' which 
^ the system derives from the B and ISDN channels. 

G. Customer and Telecom Operator Network Planning 

[0050] The service records can provide detailed infpr- 

- matioh oh the -use of -network r^ources' which^cah be 
provided to network planning departments" with in tiWop- 
e>ator'and "the- ? cust6mer. : '^ f: :;1 * : ;c".c : ;.^ 

H. -Wire-tap-"" c -'* v >' -•<"■- - " ^ " v "'- CJ ' * i: 

[0051] The wire-tap capability described above r can 
be used to provide wire tap services to authorized third 
parties;' and' potentially as a trouble shootihgtbol. 

MONITORING OF H.323 GATEKEEPER DISCOVERY 
TRANSACTIONS ~! 

[0052] "As rioted' above, the' gkteke'eper discovery 
process is the process an endpoint uses to determine 
which H.323 gatekeeper to register with: The process 
can be performed manually or automatically. Manual 
discovery relies on information providerflndependently- 
* tdthe endpbint, &nd analysis of the endpoint registration 

- procedure in this case can be used to identify inconsist- 
encies in J the available "information. ' - - ° 

[0053] The discovery process stalls when an end- 

- point nriutticasts a~Gate'keeper Request message (GRQ) 
to a predetermined address (Discovery Multicast Ad- 
dress). On receipt of such a message a gatekeeper can 
either accept (Gatekeeper Confirmation message - 
GCF) or reject (Gatekeeper Reject message - GRJ) the 



request. 

m [0054] If severalgate keepers responds positively with 
'^GCF messages to 'the G RQ' message, the endppiiips 
' iffe to choose among th§m arbifrarjly. In this ^ ahal- 
5 v ysis of the choice of gatekeeper can* usefully. reveal if a 
suitable choice'was made, or it can be used to verify 
assignment policies set by system managers, Analysis 
of the list of alternative gatekeepers is also worthwhile 
since it can provide information about network redun- 
10 tiancy/; ■ . , ,^ 

[0055]' Rejection messages and nbranswers to GI^Q 
' messages are valuable since they enable verification of 
assignment policies as well aslnv^stigatipn of p/objerps 
'■'related to multicasting. ''^ J "'J ^ ' 1 

is [0056]' Monitoring'' of the gatekeeper" a uto^isepvery 

• procedure is' in this embodiment "Split ihto : two prdc^ss- 

1 - "bisp'atcher process (Figure 5); ^ricJ * ']/ 
20 -i -* k Sig Processl ng'process (Figure '6)' ' ' J " 

[00S7] 1 ' Fief erring to Figure 5, thVDispatcher process 
collects all the GRQ, GCF ? and GRJ signalling messages 
detected by the link monitoring probes and determines 
' 2S the endpoint to which each*refens. Then, *as illustrated 
in Figure 7, the messages are dispatched to an.appro- 
' 'priaitV Sig^rccessIng "finite* sfaie machine (FSM)fprcc- 
" ess' which feMrdinatW'assfertibly of the dat^ riecesWary 
to assess the gatekeeper autdtdiscoveiry prc^eyyre in 
30 fc relalionlib a'specific ehdpoint^Th ere' heed beonlyjasih- 
gle instance of the Dispatcher process, btit sever^LSig- 
' '^Proces^in^ processes can* Be. active'at tffe ^ same time. 
■ ' [0058] z Rtefernrig to the state ' definition * language 
* r '(SDL) chart^in Figure 67 the'SigPrc^eSsihg^ prccVss cop- 
35 & sists of an' FSM which keeps track of ihe evolution of the 
' "^tekelBper ^uto-discovery r process Ifdr a y sr3Scif[c. erib- 
c '* point? FortiVe'sake' of Clarity and si'mpiicity,^ ^the^crialrt'has 
r beeh 1 9esigned , witlrth'e assumption that tffe mb'nftbring 
system is installed before endpoints start the gatekeep- 
~40 er discovery process. In practice some endpoints might 
already be in the middle of the ^gatekeeper 'discovery 
process when the monitoring system is first instaNed, In 

• "this' case-'ari3CF of ;GRJ v rriessage is this first t<f be J re- 
*' ceiveb ?n respect of such an endpoiht, and the' behaviour 

45 of the FSM shown in Figure 6 may be~determiried at the 
discretibn ; 6f the'system operator: incomplete informa- 
tion may be collected or, alternatively, the signalling in- 
formation involved may be discarded. " J fc 

• [0059] : In relation to an endpoint, the measurements 
so that can be collected and used to assess the overall 

gatekeeper auto-discovery process include: 

?v - .:• « * z : ' - i - 

list of available gatekeepers (derived .from. GCF 
fnessagers time-stamped and ordered); ^ 
ss "list of gatekeepers 'that rejected the GRQ request 
(derived from GRJ messages time-stamped and dr- 
**• dered); : ' p : ' j 

- Sf list'of alternative gatekeepers; 
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alarms Xnp answers to GRQ messages; GRQ re- 
transmissions too quick or too numerous); 
warnings (RIP messages, i.e. gatekeepers too slow 
. „ t . ,to answer). 

The j *\ GRQ andthe GCF or GRJ can be time-stamped 
and statistics about response times can .be derived. 
[0060] Sirniiar statistics can. be alsb obtained for dis- 
covery process performance from tHe point of vjew of 
gatekeepers. 

J0061] Jhe case of endpoints.that do not receive any 
/answe/to thif i'r CSRQs can be worthy of study. Two.caus- 
es pa^h. be '.identified fpr.this behaviour GBQs may be 
: s^nMq a multicast address different from the predeter- 
mined DiscpyeryMulticast Addre.ss, reveal in grin is^on- 
tiguration at the endpoint: or, as shown in Figure 8,ihere 
may bo configuration problems, within a router causing 
the router to fait to forward multicast requests from on© 
. sub-net to. another Clearly there Js also : the possibility 
" of "network disruption Uvii occurred at Ihe time an end- 
point tnt'v-itvd :t t y U;itt.Kc*cpei discovery procedure. For 
. this roason it is irnpoiwu tp c keep.a .recprcTot timing in- 
'fcjrrraticrt since rt nitons later correlation ilwith f pther,ne,t- 
* work bvonti. ^ \ . , , »~ ^ , ' [ J ..' 

[0062] Jfyc s^qrvi^ng messages involvcd.in tba.gate- 
keepoV cUscovory procedure and, in particular, the fields 
, carrying key cut.-* to* fnonitoring tl^is. procedure, . are 
f sumrnaryp<Jjtc*c^ fhts summary focuses on ;the es- 
se ; htia\licic?si tfy> irp. mor a data can be^ extracted jf pfe- 
. sired jrorn frvp s»grvinrvg messages Jn order to provide 
,,rrtorecc*T^ overall gatekeeper 

di§cpvery proce^s^ ' .. "I \. \ 

. Gatekeeper Requbs* ( GRQ) ""T V 

joo63]., r ..... , , 4 . ... v r - 

r reqSeqNum This, allows- cprreiaiiqa f wilh subse- 
quent sigrtallrig and.GRJ /me'ssag^)*origihat- 
\* ed in response Jo thts. request. . „, f.l ' 
. * , ras Address Transport , address of, .ihe \ endpoint 
v " . '(Registration Admissipn ancLstatus -RASXchan- 

endpoint Type This identifies, the type .of endpoint 
(useful lor consistency checks), ... ,. V" . , '/ . 
gatekeepericentider This should be empty, Qther- 
T wise, i? contains the identifier of the r gatekeeper the 
: endpoint is interested in registering with. . *. 

Gatekeeper Confirmation (GCF) . 

[0064] 

reqSeqNum. Must be the same as in the corre- 
sponding GRQ message. 

gatekeeperldentifier. This identifies.the gatekeeper 
that is sending the GCF. 
. i ras Address - Transport address, used by the gate- 



, keeper for registration and status, messages. 

- , alternateOatekeeper. Prioritised sequence pf alter- 
\ r . native } ,"g9tekeepers";and related RAS^ddresses, 

5 Gatekeeper R ej ect feRJY . . ' 

. [QQ65] ^ ^ ' / v V, 

- reqSeqNum! Must be. the same as in' the corre- 
10 . sponding GRQ message. 

'-" , ; gatekeeper1dentifier. This identifies the, gatekeeper 
/ 'that is sending the GRJ. ; * 
rejectReason. Cause code related.to th is rejection. 
altemateG ate keeper. Prioritised sequence of alter- 
is : native .gatekeepers and related RAS addresses. 

, altGKisPermanent This indicates ]if .future., RAS 
nnessages should be redirected to. the alterhative 
gatekeeper^ or not.. * ^ , - - ^ 

20 MONITORING QF ENDPOINT REGISTRATION . , / 

[0066] The endpoint'registration procedure is comple- 
mentary;tothe.gate keeper discovery procedure, and en- 
ables an endpoint to join a "zone" managed by a chosen 

^5 gatekeeper and inform the gatekeeper, of its Transport 
. .Address and Alias addresses. Monitoring, of this proce- 
dure enables the zone managed by one gatekeeper to 
be, independently determined. It also, allows correlation 
ot the information, gathered during monrtpring pt ihe 

30 gatekeeper discovery procedure in prder to assess the 
choice of specific, gatekeeper by, an endpoint.^ . 
[0067]. Registration js mandatory and. must be done 
before any call is attempted. Furthermore, it may, occur 
periodically according to the. gatekeepers policy. , It 

35 might happen that the f requency ptthe regist ration proc- 
ess is very low and that therefore i signalling related to 
. .{he registration, process is rarery. captured. As an alter- 
native monitoring of -the admission procedure (e.g'. ac- 
cording to recommendation H.225>,can be, used to cre- 

40 ate, sjmilarinformation to that gathered through monitpr- 
. ing of the registration process. . ./ .,, .* .. . 
[0068] ; : The registration process involves/ only three 
...signalling messages; usually it follows the rgatekeeper 
discovery, process. An t endpoint sends a Registration 

& Request message (RRQ) to a.gatekeeper, -using the 
gatekeeper's RAS address, which . is known from, the 
previous gatekeeper discovery process. On receipt of 
such a message the gatekeeper can either accept or 
reject the request and replies with a Registration Cpn- 
; so firmat.ion (FJpF) or Registration Reject (RRJ)r message, 
respectively, -Reasons for rejection of the registration 
can include ambiguous registrations and , security is- 
sues. 

. [0069] The registration process can be periodically re- 
55 peated since each registration may have a finite life. 
, Moreover updates in an endpoint's Transport Address- 
es and/or Alias addresses are notified through new reg- 
istrations. . . „ „• - 
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[0070] Cbsely related iq trier" yegiltratibri process is 
the unre'gistratjon process, by jwfijch' afid endpoint and 
a gatekeeper cancerthe relatlohship' which exists be- 
tween them. Either an endpoint pr a gatekeeper can in- 
itiate it. It also consists of three messages." the Uhrag- 
ister Request (URQ) message triggers the procedure, if 
initiated by a gatekeeper the endpoint has to acknowl- 
edge it by replying with an Unregister Confirmation 
(UCF) message. If initiated by an endpoint the gate- 
keeper might reply with an Unregister Reject message 
(URJj. This might be 1 due to the fact that" the, endpoint 
was not in fact previously registered with this gatekeep- 
er, trve unregistratibn procedure may or may ; fidt be ih- 

* voked before"aVe:r^gistration. 

[0071 " A gatekeeper must keep a oheMO-one map- 
*" ping between transport and Alias addreWes. Changes 
- of both transport and A lias addresses at once pari 'occur 
and they should be preceded by use of the un registra- 
tion procedure ^ . ' , _, t > 
[0072]' Monitor ihg of the registraLioh procedure' inval- 
uable for several reasons. It can provide information 
"heeded to define* zones and provided mapping between 
transport Addresses and Aliases. Furihermdre/ securi- 
' ty policies can be monitored arid verified and, eventual- 
ly; fraud or fraud attempts discovered. Gateftbeper idhd 
^balance can-also be usefully anaiyseS/Fihally/rhapping 
*■ of the^erfeipoihts that belong to a^one in conjunction with . 
1 depiction of the physical representation 1 of the network 
^'topology (e.g:''ffer?ved XisYng^auto-discove'ry' facilities in 
" the~H ewlett-PackaVd Open View net vito'rk' management 
tool) can be exifernely useful to identify' 'h^two^prob- 

* ferns -such r aS conriedWity 5 bottleneck or unsuitable 

* gatekeeper choicest **'~ ' e ' 1 j ^ ' * 
[0073] •As'mehl roh ed earl ier, the' admrss ion p roced u re 

: can be used ¥im?latiy 'to theVegislratidn^ 

* generate^data about the'-zone discovery. rnlhisdase, 
algorithms similar tcrthose desciribeti herein cain%e used 

' by -repla'cing'F^bV^ 

* with AW/resp^cniv'eiy " Z^ 0 / ' : 

" [0074] Pfbcesfeirig of -the registration and unfegistra- 
tion signalling is split into two: A first Dispatch er process 
e (shown in c 'Figure 7 9) reedgnises if any of the registration 
^br'unre^isfr^idn rnessages that are captured refers* to 
any endpoint already registered or in the process of do- 
£ ing sd: As illustrated by reference agaih to Figure 7, the 
"Dispatcher^Tbdess also dispatches* the sighalfihg mes- 

* ? sa<ge to one ofYwo Sig Processing processes which ex- 
' tract the data necessary for zone discovery. SDL charts 

for these* twd'p recesses are shown in Figure 10 (regis- 

* tration) and Figure 11 (unregrstrafion), respectively. v 
[0075]- the measurements that can be collected in 
this way and used to generate data about zones include; 

endpoint 4^^gatekeeper relationshfp (ctynamic re- 
: lationship); - • Cl * ' • • ? " ' 

r - Transport Address i- — > Alias Address cdfrespond- 
- * erice (dynamic relationship);* ' f ' 1 *' * v - 1 
gatekeeper load balance; * 



- * alarms (ho answers to request rnessages); 

warnings (Rl P messages, i.e. gatekeepers too slow 
to answer); 

mapping of a zone over the physical network topol- 
' 5 ogy; 

assessment of the choice by endpoints of the gate- 
keeper to register with; . % 
analysis of rejections of registration and unregistra- 
"tioh attempts. - jX - - 
10 : f ■ 5 ■" 

' The eridpoint-gateke'eper relationship is a temporal re- 
lationship which has a related start and dndtime.^imi- 
larly, the identification of endpoints through Ali^S arid 
Transport Addresses is dyftamlc and it must tie assbci- 
is ated with timesfempsr. Consistency checks should pref- 
erably be carried but to Verify thara unique mapping ex- 
ists belweeh an Alias Address and the related Transport 
.Address. ] l " v ' \ 1 ' ' " 

[0076} 'It is possible to highlight cases of endpoints 
v "20 that do 1 not receive' any answer to RRCTor URQ mes- 
sages! this mi grit be due /for example, to the use of an 
'incorrect 'gatekeepeif RAS' address* the 'information 
" gathered 1 a* Bout trie registration* procedure can 'be used 
to assess the choice of gatekeeper with which 5 endpoints 
' 25 'register a!hd, u Itimatety, to'determine abnormal cbnfigu- 
■ rations; ■ - ■ 

[0077] Moreover, ft is useful to map zohes relative to 
* physical network 1 topologies. ' For example,* Figure 12 
shdWs two sub-nets, each with a 'gatekeeper anci'sey- 

30 eral endpoints; More specifically, two endpoints in the 
sub-net A are registered with a' gate keeper* 6 K§ that is 
associated with another sub-net, sub-net B. This-may 
be a desirable behaviour justified by gatekeeper load 
balancing policies. However,- it might also-be anomaidus 

35 behaviour , 
[0078] With regard to gatekeeper load balance^ Fig- 
ure 1 3 shows schematically the traffic between the'end- 
poirife and the gatekeepers dri^the same sub;het:" Clear- 
ly load irftbalancW exists between the two gatekeepers. 
^40 As in the previous case, this may be a desirable behav- 
iouf. : : But ft/night also reveal the existence of a situation 
that' doe's hot match ihe desired policy puf ih place by 
the system administrator 

: P079] Rej ectiori m es*sages, su ch as RR J dr U R J , can 
"45 be useful to highlight either configuration or security re- 
lated problems, e.g. fraud attempts:' ' 
' [0080] The signalling messages involved in the 1 regis- 
tration and unregistration procedure and, in particular, 
the fields that carry the key data for the monitoring of 
* : so these procedures, are-summarized below: - - 

Registration Request (RRQ) 

10081} s 

- * r requestSeqNum; Mdnotonically increasing number 

unique to the sender ' : " *■ 

discoveryComplete. Set to TRUE if the registration 
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follows the gatekeeper discovery process. It could 
• "-'happen 'that : whW a registration' ages, the gate- 
keeper discovery has to be invoked before attempt- 
■ ihg a new registration. This is one possible reason 
' ' for rejecting an RRQ or ARQ; :,v 1 
— callSighalAddress. Call signal I ihg address for the 
ehdpoint. ' ' * - " ; * ~ ;T; ~ 

rasAddress. Transport address of the endpoint 
(RAS channel). - " - ; J/:. ' 

terminalType. This identifies the. type of endpoint 
(useful for consistency checks). : x ■ 

'■■tefminalAlias. This should be 'erripVy: Otherwise, it 
" ■contairis'a'list'of Aliases to identify the ehdpoint. 
' Gatekeeperldentif Sen The giatekeeper ;with ^tfbich 
the terminal wishes to register. " * 

• 3 alfemateEncipoints. A sequence of endpoint" 1 alter-' 
''natives for Cal IS ignaliing Add ressV rasAddress, ter- 
minalType, or terminalAlias. 



Unreqistration Request (LrRQV 



[0084] 



requestSeqNum. Mohbtohically increasing number 
unique to the sender. ' 1 \ 

callSignalAddress. Call signalling address for the 



endpoint : ^ : c . . . .. n 

reason. Re2^OTjoj 1( the^uhregistration initiated. by 
the gate keep'er'/\ '' _ 

5 Unreqistration Confirmation (UCF.) 

[008JS] _ , - — 

- requestSeqNum. Sarheyalue as for the O.RQ. : . 

Unreqistration Reject (URJ )" 



10 



Registration Confirmation (RCR 
[0082]- 



' requestSeqNum. Same value as lor tfie^RF^/ ' 

° caUSignaiAddress: Tr^i^n^kSdreases for ' H. . 
; 1 * -255/0 signalling. ' ! ' * ' ' ' ; ; : " 

1 - * terminalAlias. 'A list of Alias Addresses assigned by 

v the gatekeeper by which l OtheYte^m^ 
* 'v ehdpoint ' " ; ' ■ * : , sts* 

- (aatekeSperldentiifi^r. Tl he gatekeeper ^thsit'has ac- r . 
- - cepted th ; e : 'endp^ ^ f"; VJ 

- ' timeToLive; Duratfbn of 'the 1 validity' of trte regj&ra- 

tioh. J r " ' _ *' ^ v" - ;V ' sr r 
^ preGrahtedARQ. Special pfe^gr&nted^p^ 
to make phone calls'." " v *\ i " : - i ^ ^ ; !: 

Registration Reject IRRjy \ : * f ^ rr \ >r> 

[0083] ' ' ' "' ;f ^-^-^ * ! ^' r 

"requestSeqNum . Same yal ud' as'Jf or the RRQ." ' ; 

- ' rejectReason. The reason for'* the > rejection of ihe 
' '■' registration. V ^ 

- '/'Gatekeepe;Hdem|fier riafe'.re- 
; jected the endpoint registration:' ~ \\ " / 

- aitemateGatekeepef. Sequence of pribrrtfsejd'alter- 
; ' : native gatekeepers with which to retry requests. 1 

- altGkisPerrnaneht. True or False, indicates if ^al I 
subsequent messages "are id be redirected to the 

; ' alternative gatekeepers. ; ' I rt . 
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RequestSeqNum. ^Same value as for the URCU, 
rejectReaspn. The reason for the rejection, of . the 
Unregistratipn. ^ " . . V '.V..- , \. . , 
aiterQateGatekeeper. S.equencVjbf prioritised alter- 
native^gate keepers^ to "retry - requests^ 

altGKisPermanent.* True or Fajsa. Jndicates.^f [ all 
subsequent rnessage's are to be redirected, to /the 
alternaiive. ; gateke.epers. ~ , 



; EXAMPLE 1 - ^Two Endpoints Communicating 
2$ Directly without a Gatekeeper ' 

[0087] \ In this first example it Is assumed, that: - 



30 



35 



40 



45 . 



SO 



55 



~ the _ underlying^ \ s 
\used to provide reliable connect ions and UDP is 
. used to provide" unreliable .connections;.. 
tt the two endppints^comm 

' use i of a gateteep^e/ - this simpli^ process be- 
cause the' Call Signalling Channel uses .a. ""well- 

. known* T§AP- identifier (specified iaTecomrnenda- 
tion K the Cajl Signalling 

ChanneJ .is' Jdebtilledl through an interaction with a 
gatekeeper js described in Example. 2 below; 

\ there ^are r only" twp : endpoints, which intete one or 
more audb^pr video, connections using Real Time 
Protocol '(BTP); ; ^ [\1 \"\ ' ^' ,. r . rt 
the calf is hot .modified during the/ session, for ex- 
ample by adding new participants or requesting 
changes in bandwidth; f 

the Call Signalling "Channel remains open for the 
duratipn,of the^session, and, a RELEASE CQM- 
_ PLETE message is used to terminate the session. 



[0088] Th e fin ite state mach ine p recesses req u ired to 
monitor this type of session are as follows; , . 

.i -.Call-Sighailjhg' Channel FSM (see. Figure 14) . > 

[0089] This monitors all Jinks continuously looking-for 
a reliable-connection setup, (for example, the SYN of a 
TCP connection) using the well-known TSAP identifier 
for the Call. Signalling. Channel. Jn.rasponse to a Call 
Signalling Channel being, established, this process ini- 



,10 



BNSDOCID: <EP 0948165A1_L> 



! EP 0 948 165 A1 



20 



tiates a new Call Signalling Message J^Srvi (CSM-FSM 
' - see item 2 below) to monitor Channel and passes 
to it the transport addresses of theTfwo endpbints. 

2. Call Signalling Message- ^sfa isee'Fiau re 15^ 

[0090] This is initiated to monitor a specific Ciall Sig- 
nalling Channel, and is terminated when the ^reliable 
connection is terminated 'for that Channel (for example, 
by the FYN of the TCP connection). It continuously mon- 
itors the Channel for signalling messages. A SETUP 
message indicates the start of a new call, and causes 
the process to create a new service detail record (StJR) 
for the call. The calj identifier is used to uniquely jdentify. 
the-servfce detail rec6rd for trie duration of the call, and 

' td : identify 'subsequent call signalling messages. The 
service detail record is populated with a time stpmp, and 

* ■* any* useful fiel<Js%ofn"th : S SfeTUP"niessage'. * _ 

[bo^lf* The : C ONNECT message serif from the called . 

' : endrkiimnbrrriaTly carries the transport addresses to be 

,{l used for the .^45'-COn*trc5l Ghanrlel. in response to this 
message an H.245 Control channel FSlvf (ffdrJ-FSM - 
see item 3 below) is started, to monitor the t H f 245, sig- 
nalling for the session. The service detajl record is pop- . 
ulated with an addrtiortal ffrni sta"mp if required, 3 arid any * 
of the useful fields from the CONNECT message,.. . 
[0092] A A RELEASE COMPLETE message indicates 
the termination of the session. The service detail record 

^ is u pclated with any 'relevant data ariefti me' stamps , and . 

*" then c^ed"1^e^:S4fefeontrdl CharlnerF^rvl ^monitor- 
ing the H:^45 ; s1&naffirig^^ moni- 
toring for sulrae^uerrt s^ continued 
in order to capture jurthelc end- 
points.*^'-" iV 1 - ' ,pr - f - f i' r J t ' " . 

' [0093] x Therraih^ 
ure~1 5; : howeverln frfe iffiere%ts pf clarrty~e"rrbr conditions 
have been omitted. The : captWe df %ther signalling mes- 
sages, partic'ttarljr' those ^irivolved In modifying calls, 
could also te captureo 1 and 'used to update Jhe Jservice . 

f ' detail r 7ec6rcf- with : Sabttitibnar^ time ' 

stamps. It may also be required _to' lnit^t^;'ftjrther FSMs 
to monitor other aspects of 'the Ball. c f 

3. H.245 Control Channel F5M jfsee'FiQqf^ 1'6V; 

• "v." *■*»..' - '•; !'l-: . t ^ • •» - - 

[0094] r This is initiated from the'fcall'S'iQnalling Mes- 
sage FSM*ahd 'monitors ail messages dh The~H.245 
Control Channel for the duration of the call.. The£SM is 

* terminated by the detection df ^n J ena^essionComniand 
message on'the J H.'245 Control Channel. Logical chan- 
nels are opened and closed using the open Logical- 
Channel and closeLogieafChanrfel messages:-The FSM 
detects the opening of a Channel, extracts the relevant 

: data and initiates two new FSMs to monitor the forward 
and reverse Real Time Control Protocol (RTCP).;cbn- 

'nections' (RS-FSMs - see item 4'below): A logical Chan- 
! nel-fs uniquely identified by the Logical Channel Number 
(LCN). This is usedto identify the RS-FSMs to be "ter- 



minated when .the close Log icalChannel messages are 
received. , . : ., r ..,.^. 
[0O9j5],. TThe main process paths are indicated in Figure 
16; however there are many^ mora . messages; on the 
s Control Channel which could b&oapturedto^prpyide ad- 
ditional information in the service detail record.,; 

4. RTCP Session FSM n ^- _ ! ; 

10 [0096] The RTCP connection provides detailed infor- 
mation, .on JhQ performance of the RTPjcgnpection that 
it contrpjs'. XNs pan be captured as required I to provide 
..quality of seryfce information irvthe seryice-detail record, 
the RTP stream itself, may be monitored at, multiple 
*5 points in its path tq make quality ot service jmeasure- 
r meqt r S wthich can be^addec! to the service detail-record. 

EXAMPLE 2 -Endpofnts Communicating via a 
Gatekeeper c , r . . 

20 ' - - - — 

[0097] When a gatekeeper is involved the CaJI Signal- 
ling Channel may no longer be carried on the well- 
known, Transpprt ^Cjdress; instead/a dynamic t TSAP 
^ideHtiiier whic^ from the gate keep - 

2S er may be used. The FSM for this situation is^snown in 
m Figure^ 1 7 V This . process, uses the , information- abqut 
gatekeepers . and .endpoints ac v qu i red^d uring, the gate- 
kdepeY discovery process. The RAS Channel between 
_al Legate keepers aq^. endpoints is continupusl^ moni- 
30 tored for control./ messages. An.^dmissjon , Request 
(^RQ) foljowed by^ari 1 ^ (ACF) 
means that the' enbpoint has requested to setup a call 
and has jDeen^alJowed to. do so by .tr\e.gate keeper; The 
Transport XcfdresYWhich wil perused -for the- Call Sig- 
3S nailing Channel can be obtained from the Admission 
Confirmation message. ACalLSignalling Message FSM 
is initiated to monitor the r^tdbld"cWnectidn foT'tfiat 
Transport Address. The remainder of the processing 
proceeds in a similar manner to Example 1 . 
40 [0098] The^exampje jn figure .17 srjows the generic 
_ c;ase of sinfigly Identifying tn^ Signaliing Channel, it 
~ 'is s1raighrfdrwa>d to^extend this to include the.creation 
pf the service detaN^ record in response to arj-Abmiss ion 
* Request* messagejfrom the endpoint^o the gatekeeper. 
*s TjTijs enables the creation of service detai I records wh ich 
' Include jnforTpatioh and time stamps taken from the call 
related'messages oh the RAS Channel. It also enables 
-the generation" of service detail records in the case 
where an Admission Reject message is received and no 
so call Signalling Channel is ever established. 

[0099] The presence of.gatekeepers may also affect 
the call clearing process: Typically a disengage 'request 
(DRQ) message is transferred between the endpoint 
and the gatekeeper as part of the call clearing process. 
ss [0100] The Call Reference Value, (CRV), jn cases 
where it' is "implemented by. vendors, .can be used 
throughout the call as a unique identifier for all the mes- 
sages. 1 
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[01 01] The processes described above can be split in 
many different ways between the probes and the other 
processors in the Distributed Management Infrastruc- 
ture. There are established methods for choosing how 
to distribute the processing; the Hewlett-Packard 
acceSS7 architecture provides one example of how this 
may be achieved. 



Claims 

1- A method of generating generalised service detail 
records for communications carried over a packet 
network, comprising the steps of: 

acquiring packet network service data from 
packets carrying the communications; 
acquiring signalling data from a signalling pro- 
tocol to identify at least one of addressing, con- 
figuration, status and liming information for, 
endpoints, gatekeepers and connections in- 
volved in a call; and 

combining said packet service data and said 
signalling data to generate service detail 
records. \ 

2. The method of claim 1 , wherein some or all of the 
data are captured by a passive monitoring system. 

3. The method of claim 1 or claim 2, wherein packet 
network service data aire acquired from the protocol 
headers of the packets carrying the signalling data 
for the service. 

4. The method of any one of the preceding claims, in- : 
eluding using the information identified from the sig- 
nalling data to identify the logical channels carrying 

. the media streams, and capture some or all of the 
packets on the logical channels in real-time at one 
or more points in the network. 

5. The method of claim 4, wherein captured data are 
used to measure the quality of service actually 
achieved by each channel. 

6. The method of claim 4, wherein captured data are 
used to provide secret access to the media stream 
for troubleshooting or surveillance purposes. 

7. The method of claim 6, wherein addressing infor- 
mation for the target user is used to select the cor- 
rect signalling packets, potentially in conjunction 
with data from a network discovery database. 

8. The method of any one of the preceding claims, in- 
cluding correlating the data from the packet network 
with data collected from a switched circuit network 
(such as a PSTN, ISDN or B-ISDN) to enhance the 
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,. generalise^ ..... 

9. The.metbcd.o^ data col- 
lected f rpm.p^ssi^ ,of A a signalling net- 

. . work (e.g.JsS7ior access signalling (e.g. ISDN, B- 

10. The method of claim 8, including useqf data col- 
lected from the switched circuit network for audio or 

. yideq quality. ...... r . _ : 

11. The method of any one of the preceding claims, in- 
cluding using the generalised service detail records 

..tQ.bill forthe service, optionally taking into account 
. , the quality of service : .and usage data, and optionally 
- |nciMding : trackingtp see jfcystomerst\aye been ex- 
ceeding their agreed bandwidth .constraints. 

12. The method of any one of the preceding claims, in- 
. ^eluding using the. generalised service detail records 

to detect potentiajly.frajuj^ulent.^endce. usage, per- 
L , form. network planning, perform marketing studies, 
3 ; perform network operations functions, ^modify the 
network configuration in real-time jtaachieve quality 
of service objectives, and/or perform customer care 
2 „ : ^ functions^ ... r ... , ■ r: - ; 

.13. A method of discovering .the ^network configuration 
of the endpoints, gatekeepers and their relation- 
ships, for a communications service carried by a 

::r ^packet network,; by usjng a passive monitoring sys- 
i , . . ; tern to capture .the signal i in g m essages involved in 

.» . the configuration; and negotiation of- relationships, 
addressing and. resource allocation^ between end- 
points and gatekeepers. 

~ 14- TKe method of claim 1 3, wherein the signalling mes- 
sages captured are gatekeeper .request, gatekeep- 
er confirmation and gatekeeper reject messages. 

The n^etho<^f;Claim 14, v^ereindata are extracted 
. v from the captured signal|ing ; messages to identify at 
(? JeasXoneof the^following types of -information: avail- 
. able gatekeepers, alternative, gatekeepers, gate- 
keepers rejecting request messages, endpoints 
which receive no response to request messages, 
and gatekeepers which are excessively slow to re- 
spond to requests. 

16. The method of claim 13, wherein the signalling mes- 
sages captured are endpoint registration request 
messages and associated registration confirmation 
and reject messages. 



15. 



55 17. The method of claim 16, wherein data are extracted 
from the captured signalling messages to identify at 
least one of the following types of information: rela- 
tionships between gatekeepers and endpoints, cor- 
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relations between' TraVi^SH'Aiddf esses and Alias 
addresses, gatekeeper load balance, endpoints re- 
ceiving* no* resironse-to ''request rnessage gate- ^ 
" " keepers which' are »%ssi&Sf|rsBw to respond to ; ^ 1 1 ' ^ s ~ s *° " ' e ,:: * u, 

- requests! ! correlatibW^etweeh^ gatekeeper zones 5 
and physical network topology, choice by endpoints 
of gatekeepers with which to register, and rejections 
: of registratitJn requests. "** v 

18. A method of generating generalised service detail 10 
records for communications carried over a packet 

hefwbrk, comprising the 1 steeps ofr-^* 9- ' *'* ^ ' A 

acquiring packernet work servide data for the *- " - : * 

;- r -" j" packets caTrying/Me^c^ ' *5 

* r " acquirirVg"$ighall^ " ' °-' t '" * " r-vi. 

'■ of ea^'confrbr, registration, admissforts? band- 
width management, call status, address trans- 
latioriiaVid fiiteingehrnelwc^ ; services; " 
** - ( -acquiring quality c^service data fSf the service 20 
' - -'L ;i transmission level;' and yo 
' - : ,/: ■ ebm^ningsaici service data, said'srcjnallihg da- 
' ^ ' ta^and^aid quality ^f service liata to generate 

- '-generaiised sfervice'dMH irec&rdsV " n ; L >: " v,Nn63 

19. The method of any one of the preceding claims, 
wherein the capture of packets is performed at mul- 

'■■■"^ 'tiple^irife'ih-T^ real- ' ■ '* r • ;: 

* -'--'time; H '' h * J ^• ; ^ : ^ v ^: -<- J ' - ■•' 

■ v ? ~ r<f • / e ;ic ; " ^in ur» • t ~ : ^o. ,v .§q >'2?z 4 ->i-=>."'v-. 

^ 20. The fT^thdd' d^any^one 1 of trie 1 ' prdce'drh'g^claims, 
- - v whereFri. Ihe^'cbrnmOhfeations " comprise Teal-time 
,i -v6ice-o , r*§udk>/fax?^6ic^ vid- 
h - : - eo bh^uttimediacc^m^ 

21. The method of any one of the preceding claims, 
' - ~ twh ef e-iri^th S- packei-net worltis an" J R * ffame re lay r or 

-ATM- heWrk}^ ^ - ^ c-^?,? " - ( i ^ 

22. A method of monitoring a packet data sub-network v '"40 
j: da 6Y lih^ OTmpnsrhg'the^steps of : : rribriitdr ihg at a first 

- lobatidh -"signal irng^rhessages id detect The * exist- 
- ehce r of-a oall;%nd rhohitbring at muffiple other lo- 

■ • ; . cations to fderit ify * some or alf packets associated 

* with the ^all^ : I " ' ^ "45 
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